mirror of
https://github.com/windmill-labs/windmill.git
synced 2026-08-25 08:00:59 +00:00
Ruben Fiszel
6739211dbc
Forking a workspace clones its apps. `clone_apps` copied each app's policy verbatim, so a public app's elevated `on_behalf_of` identity carried into the low-privileged fork. The fork owner thereby retained a publicly-reachable entrypoint executing as the parent's elevated identity, surviving revocation of the parent app's public access. Any non-admin member can create a (non-dev) fork. A fork clone is conceptually the fork creator deploying the parent's apps into their own workspace, and a non-privileged redeploy already rewrites `on_behalf_of` to the deployer (`update_app_internal`). The clone just skipped that step. Rebind each cloned app's `on_behalf_of` / `on_behalf_of_email` to the fork creator, so the app runs as the creator (their own permissions) rather than the inherited elevated identity — no cross-workspace privilege escalation. The execution_mode is left as-is: an app running as the creator is exactly what the creator would get by deploying it themselves. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Windmill Backend
This folder holds all backend components, the src/ folder only contains files used to build the "root" binary.
Components
| name | description |
|---|---|
| windmill-api | The API server, exposing functionality to other components and the frontend |
| windmill-audit | Contains audit functionality, allowing different components to record important actions |
| windmill-common | Common code shared by all crates |
| windmill-queue | Contains job & flow queuing functionality, commonly written to by the API server and read from by workers |
| windmill-worker | The worker. Used to process and execute flows & jobs. |
| parsers | Contains code to parse signatures in different langauges. |
Compile sqlx for offline ci
cargo sqlx prepare --workspace -- --bin windmill --features enterprise